Implement OpenShift Tests Extension (OTE) framework for INFW

Integrate the OpenShift Test Extension framework to enable external test
contribution to openshift-tests suites with proper OTE library usage.

Implementation details:
- Use OTE library API instead of custom implementation:
  * extension.NewExtension() to create extension registry
  * ginkgo.BuildExtensionTestSpecsFromOpenShiftGinkgoSuite() for test specs
  * cmd.DefaultExtensionCommands() for standard CLI commands (info, list, run-test)
- Define test suites with CEL qualifiers:
  * openshift/ingress-node-firewall/conformance/parallel (excludes Serial/Slow)
  * openshift/ingress-node-firewall/conformance/serial (Serial tests only)
  * openshift/ingress-node-firewall/optional/slow (Slow tests only)
  * openshift/ingress-node-firewall/all (all INFW tests)
- Build statically linked binary with CGO_ENABLED=0 and GO_COMPLIANCE_POLICY="exempt_all"

Test implementation:
- Add LEVEL0 test case: OCP-61481 - Ingress Node Firewall Operator Installation
- Add E2E test utilities: OCClient for oc command execution
- Add Kubernetes helper functions for namespace, pod, deployment operations
- Implement test using Ginkgo v2 and Gomega assertion framework

Build and packaging:
- test/Makefile: Build target for static test binary with ART compliance
- Dockerfile.openshift: Include compressed test binary in container image
- Makefile: Top-level target to build test binary

Validation:
- Binary: 40MB, statically linked (no dynamic dependencies)
- Commands functional: info, list tests, list suites, run-test
- Conforms to OTE framework requirements and OpenShift operator patterns

Signed-off-by: Anurag Saxena <anusaxen@redhat.com>
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: anuragthehatter

Dockerfile.openshift

@@ -14,13 +14,19 @@ COPY controllers/ controllers/
 COPY pkg/ pkg/
 COPY vendor/ vendor/
 COPY bindata/manifests/ bindata/manifests/
+COPY test/ test/
 
 # Build
 RUN CGO_ENABLED=0 GO111MODULE=on go build -a -mod=vendor -o manager main.go
 
+# Build extended tests
+RUN make -C test build-e2e-tests && \
+    gzip test/bin/ingress-node-firewall-tests
+
 FROM registry.ci.openshift.org/ocp/4.22:base-rhel9
 WORKDIR /
 COPY --from=builder /workspace/manager .
 COPY --from=builder /workspace/bindata/manifests /bindata/manifests
+COPY --from=builder /workspace/test/bin/ingress-node-firewall-tests.gz /usr/bin/
 
 ENTRYPOINT ["/manager"]

Makefile

@@ -480,3 +480,12 @@ podman-build-daemon: ## Build the daemon image with podman. To change location,
 .PHONY: podman-push-daemon
 podman-push-daemon: ## Push the daemon image with docker. To change location, specify DAEMON_IMG=<image>.
 	podman push ${DAEMON_IMG}
+
+##@ Extended Tests (OTE)
+.PHONY: build-e2e-tests
+build-e2e-tests: ## Build the extended e2e test binary for OpenShift
+	$(MAKE) -C test build-e2e-tests
+
+.PHONY: clean-e2e-tests
+clean-e2e-tests: ## Clean the extended e2e test artifacts
+	$(MAKE) -C test clean

test/Makefile

@@ -0,0 +1,47 @@
+# test/Makefile - Build targets for ingress-node-firewall extended tests
+
+SHELL := /bin/bash
+
+# Binary name
+BINARY_NAME := ingress-node-firewall-tests
+
+# Build directory
+BUILD_DIR := bin
+BINARY_PATH := $(BUILD_DIR)/$(BINARY_NAME)
+
+# Go build flags
+GO := go
+GOFLAGS ?=
+LDFLAGS := -w -s
+
+# Version information
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "unknown")
+GIT_COMMIT ?= $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
+BUILD_DATE ?= $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+# LDFLAGS with version info
+LDFLAGS += -X github.com/openshift/ingress-node-firewall/test/version.Version=$(VERSION)
+LDFLAGS += -X github.com/openshift/ingress-node-firewall/test/version.GitCommit=$(GIT_COMMIT)
+LDFLAGS += -X github.com/openshift/ingress-node-firewall/test/version.BuildDate=$(BUILD_DATE)
+
+.PHONY: all
+all: build-e2e-tests
+
+.PHONY: build-e2e-tests
+build-e2e-tests: ## Build the extended e2e test binary (static, ART compliant)
+	@echo "Building $(BINARY_NAME)..."
+	@mkdir -p $(BUILD_DIR)
+	CGO_ENABLED=0 GO_COMPLIANCE_POLICY="exempt_all" $(GO) build \
+		-a -mod=vendor \
+		-ldflags "$(LDFLAGS)" \
+		-o $(BINARY_PATH) ./cmd/main.go
+	@echo "Built $(BINARY_PATH)"
+
+.PHONY: clean
+clean: ## Clean build artifacts
+	@echo "Cleaning test build artifacts..."
+	@rm -rf $(BUILD_DIR)
+
+.PHONY: help
+help: ## Display this help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

test/bin/ingress-node-firewall-tests

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	// OTE library imports
+	"github.com/openshift-eng/openshift-tests-extension/pkg/cmd"
+	e "github.com/openshift-eng/openshift-tests-extension/pkg/extension"
+	g "github.com/openshift-eng/openshift-tests-extension/pkg/ginkgo"
+
+	// Import test suites (blank import to register Ginkgo tests)
+	_ "github.com/openshift/ingress-node-firewall/test/e2e/operator"
+)
+
+func main() {
+	// 1. Create registry and extension
+	registry := e.NewRegistry()
+	ext := e.NewExtension("openshift", "payload", "ingress-node-firewall")
+
+	// 2. Add test suites with qualifiers
+	ext.AddSuite(e.Suite{
+		Name:       "openshift/ingress-node-firewall/conformance/parallel",
+		Parents:    []string{"openshift/conformance/parallel"},
+		Qualifiers: []string{`[sig-network] INFW && !labels.exists(l, l=="Serial") && !labels.exists(l, l=="Slow")`},
+	})
+
+	ext.AddSuite(e.Suite{
+		Name:       "openshift/ingress-node-firewall/conformance/serial",
+		Parents:    []string{"openshift/conformance/serial"},
+		Qualifiers: []string{`[sig-network] INFW && labels.exists(l, l=="Serial")`},
+	})
+
+	ext.AddSuite(e.Suite{
+		Name:       "openshift/ingress-node-firewall/optional/slow",
+		Parents:    []string{},
+		Qualifiers: []string{`[sig-network] INFW && labels.exists(l, l=="Slow")`},
+	})
+
+	ext.AddSuite(e.Suite{
+		Name:       "openshift/ingress-node-firewall/all",
+		Parents:    []string{},
+		Qualifiers: []string{`[sig-network] INFW`},
+	})
+
+	// 3. Build test specs from Ginkgo suite
+	specs, err := g.BuildExtensionTestSpecsFromOpenShiftGinkgoSuite()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: couldn't build extension test specs from ginkgo: %v\n", err)
+		os.Exit(1)
+	}
+
+	// 4. Add specs to extension and register
+	ext.AddSpecs(specs)
+	registry.Register(ext)
+
+	// 5. Create root command with OTE commands
+	rootCmd := &cobra.Command{
+		Use:   "ingress-node-firewall-tests",
+		Short: "OpenShift extended tests for ingress-node-firewall",
+		Long:  "This binary contains extended e2e tests for ingress-node-firewall operator",
+	}
+
+	rootCmd.AddCommand(cmd.DefaultExtensionCommands(registry)...)
+
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

test/cmd/main.go

@@ -0,0 +1,69 @@
+package e2e
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// OCClient provides helper methods for executing oc commands
+type OCClient struct {
+	kubeconfig string
+}
+
+// NewOCClient creates a new OCClient
+func NewOCClient(kubeconfig string) *OCClient {
+	if kubeconfig == "" {
+		kubeconfig = GetKubeconfig()
+	}
+	return &OCClient{
+		kubeconfig: kubeconfig,
+	}
+}
+
+// Run executes an oc command and returns the output
+func (c *OCClient) Run(ctx context.Context, args ...string) (string, error) {
+	cmdArgs := append([]string{"--kubeconfig", c.kubeconfig}, args...)
+	cmd := exec.CommandContext(ctx, "oc", cmdArgs...)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err := cmd.Run()
+	if err != nil {
+		return "", fmt.Errorf("command failed: %v, stderr: %s", err, stderr.String())
+	}
+
+	return strings.TrimSpace(stdout.String()), nil
+}
+
+// Apply applies a resource from a file
+func (c *OCClient) Apply(ctx context.Context, file string) error {
+	_, err := c.Run(ctx, "apply", "-f", file)
+	return err
+}
+
+// Delete deletes a resource
+func (c *OCClient) Delete(ctx context.Context, resourceType, name, namespace string) error {
+	args := []string{"delete", resourceType, name}
+	if namespace != "" {
+		args = append(args, "-n", namespace)
+	}
+	_, err := c.Run(ctx, args...)
+	return err
+}
+
+// Get gets a resource
+func (c *OCClient) Get(ctx context.Context, resourceType, name, namespace string) (string, error) {
+	args := []string{"get", resourceType}
+	if name != "" {
+		args = append(args, name)
+	}
+	if namespace != "" {
+		args = append(args, "-n", namespace)
+	}
+	return c.Run(ctx, args...)
+}

test/e2e/cli.go

@@ -0,0 +1,74 @@
+package operator
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	g "github.com/onsi/ginkgo/v2"
+	o "github.com/onsi/gomega"
+
+	e2e "github.com/openshift/ingress-node-firewall/test/e2e"
+)
+
+var _ = g.Describe("[sig-network] INFW", func() {
+	defer g.GinkgoRecover()
+
+	var (
+		oc          *e2e.OCClient
+		ctx         context.Context
+		cancel      context.CancelFunc
+		opNamespace = "openshift-ingress-node-firewall"
+	)
+
+	g.BeforeEach(func() {
+		ctx, cancel = context.WithTimeout(context.Background(), 10*time.Minute)
+		oc = e2e.NewOCClient("")
+	})
+
+	g.AfterEach(func() {
+		if cancel != nil {
+			cancel()
+		}
+	})
+
+	// OCP-61481 - Ingress Node Firewall Operator Installation
+	g.It("Author:anusaxen-High-61481-[LEVEL0][OTP]-StagerunBoth-Ingress Node Firewall Operator Installation [apigroup:ingressnodefirewall.openshift.io]", func() {
+		g.By("Checking Ingress Node Firewall operator installation")
+
+		// Check that the operator namespace exists
+		output, err := oc.Get(ctx, "namespace", opNamespace, "")
+		o.Expect(err).NotTo(o.HaveOccurred(), "Operator namespace should exist")
+		o.Expect(output).To(o.ContainSubstring(opNamespace), "Namespace output should contain the operator namespace")
+
+		g.By("Verifying CRDs are installed")
+		crdOutput, err := oc.Run(ctx, "get", "crd")
+		o.Expect(err).NotTo(o.HaveOccurred(), "Should be able to list CRDs")
+
+		expectedCRDs := []string{
+			"ingressnodefirewallconfigs.ingressnodefirewall.openshift.io",
+			"ingressnodefirewallnodestates.ingressnodefirewall.openshift.io",
+			"ingressnodefirewalls.ingressnodefirewall.openshift.io",
+		}
+
+		for _, crd := range expectedCRDs {
+			o.Expect(strings.Contains(crdOutput, crd)).To(o.BeTrue(),
+				"CRD %s should be installed", crd)
+		}
+
+		g.By("Verifying operator deployment is running")
+		// Check that the operator deployment exists and is ready
+		deploymentOutput, err := oc.Run(ctx, "get", "deployment", "-n", opNamespace, "-o=jsonpath={.items[*].metadata.name}")
+		o.Expect(err).NotTo(o.HaveOccurred(), "Should be able to list deployments in operator namespace")
+		o.Expect(deploymentOutput).NotTo(o.BeEmpty(), "There should be at least one deployment in the operator namespace")
+
+		// Wait for the operator deployment to be ready
+		deploymentName := "ingress-node-firewall-controller-manager"
+		_, err = oc.Run(ctx, "wait", "deployment/"+deploymentName, "-n", opNamespace, "--for=condition=Available", "--timeout=5m")
+		o.Expect(err).NotTo(o.HaveOccurred(), "Operator deployment should be available")
+
+		g.By("SUCCESS - Ingress Node Firewall operator and CRDs installed")
+		fmt.Println("Operator install and CRDs check successful!")
+	})
+})